A previously undocumented Go-based implant discovered by Hunt.io on the attacker's staging server. It was compiled in 62 copies for both Windows and Linux, with hardcoded addresses linking to a second Hong Kong host. No evidence of deployment on ministry systems was found.